Senses

Input Injection · SynAc

TERM

Input Injection

A malicious application can inject input to the user interface to mimic user interaction through the abuse of Android's accessibility APIs.

Updated

Jan 06, 2026

Senses

Sense 1

A malicious application can inject input to the user interface to mimic user interaction through the abuse of Android's accessibility APIs. Input Injection can be achieved using any of the following methods: Mimicking user clicks on the screen, for example to steal money from a user's PayPal account.(Citation: android trojan steals paypal 2fa) Injecting global actions, such as (programatically mimicking a physical back button press), to trigger actions on behalf of the user.(Citation: Talos Gustuff Apr 2019) Inserting input into text fields on behalf of the user. This method is used legitimately to auto fill text fields by applications such as password managers.(Citation: bitwarden autofill logins)

A malicious application can inject input to the user interface to mimic user interaction through the abuse of Android's accessibility APIs.

Input Injection can be achieved using any of the following methods:

Mimicking user clicks on the screen, for example to steal money from a user's PayPal account.(Citation: android-trojan-steals-paypal-2fa)
Injecting global actions, such as GLOBAL_ACTION_BACK (programatically mimicking a physical back button press), to trigger actions on behalf of the user.(Citation: Talos Gustuff Apr 2019)
Inserting input into text fields on behalf of the user. This method is used legitimately to auto-fill text fields by applications such as password managers.(Citation: bitwarden autofill logins)

MITRE ATT&CK (Mobile, CTI STIX Data)

Bibliography

MITRE ATT&CK (Mobile, CTI STIX Data)
Accessed Jan 06, 2026Quoted
MITRE ATT&CK CTI (STIX bundle)
https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/mobile-attack/mobile-attack.json
See repository LICENSE.txt for ATT&CK terms: non-exclusive royalty-free license; reproduce MITRE copyright + license in copies. Verify requirements before publishing quoted text.
Source: MITRE ATT&CK (attack-stix-data).